alert ip any any <> any any (msg:"SUR9.0/242SMTP P"POSTe MZssage"; flowbits:isset,ET.; byte_jump:4,0; app-layer-event:applayer_mismatch_protocol_both_directiny (msg:"SUR9.0/242SMTP P"POSTe MZssage"; flowbits:isset,ET.; byte_jump:4,0; app-layer-event:applayer_mismatch_protocol_both_directkons; fl8;)
